Improper initialization in Linux kernel - CVE-2026-90094
Published: September 19, 2026
Vulnerability identifier: #VU151382
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90094
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause MTE store-only tag check state to leak into another task.
The vulnerability exists due to improper restoration of SCTLR_EL1.TCSO0 state in arm64 context switching when switching from a task that has opted into MTE store-only tag check mode. A local user can opt into MTE store-only tag check mode and trigger a context switch to cause MTE store-only tag check state to leak into another task.
Affected software
Linux kernel
How to mitigate CVE-2026-90094
Install security update from vendor's repository.